UBUNTU-CVE-2025-38040

In the Linux kernel, the following vulnerability has been resolved: serial: mctrlgpio: split disablems into sync and nosync APIs The following splat has been observed on a SAMA5D27 platform using atmelserial: BUG: sleeping function called from invalid context at kernel/irq/manage.c:738 inatomic: ...

The vulnerability of the hci_init_stage_sync() function in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the hciinitstagesync function in the Linux operating system is related to read misses beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to cause a service failure...

Oracle Linux 9 : kernel (ELSA-2025-9080)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-9080 advisory. - Bluetooth: L2CAP: Fix corrupted list in hcichandel David Marlin RHEL-87890 CVE-2025-21969 - Bluetooth: L2CAP: Fix slab-use-after-free Read in...

kernel security update

5.14.0-570.22.1.0.16.OL9 - nvme-pci: remove two deallocate zeroes quirks Orabug: 37756650 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys lis...

PT-2025-28878

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A use-after-free vulnerability exists in the vhci flush function within the Bluetooth HCI core of the Linux kernel. The vulnerability occurs when a thread closes a vhci file descriptor...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Check the dsbr size from the EFI variable Since the size of the struct btinteldsbr is already known, we can simply start checking there instead of querying the size of the EFI variable. If the final result doe...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: In btusb, there is a risk of NULL pointer dereferencing in skbdequeue. A NULL pointer dereferencing can occur when processing a QCA firmware crash dump on WCN7851 0489:e0f3. 93.672166 Bluetooth: hci0: ACL memdump si...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Handling of NULL sock pointer in l2capsockalloc A NULL sock pointer is passed into l2capsockalloc when it is called from l2capsocknewconnectioncb. Error handling mechanisms should also take this into account. A...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: MGMT: Protect the mgmtpending list with its own lock This involves using a mutex to protect the mgmtpending list from concurrent access, which can cause crashes. For example: ERROR: KASAN: Slab-use-after-free in...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: btbcm: Fixed NULL dereferencing in btbcmgetboardname. The devmkstrdup function may return a NULL pointer if it fails, but this returned value is not checked in btbcmgetboardname. Add a NULL check in btbcmgetboardnam...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: L2CAP: Fixed a slab-use-after-free error in l2capsendcmd. After the hci sync command releases the l2capconn, the hci receive data work queue references the released l2cap Conn when sending data to the upper layer...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: Added locks for usbdriverclaiminterface The documentation for usbdriverclaiminterface states that “the device lock” is required when this function is called from locations other than probe. This seems ...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: btnxpuart: Fixed kernel panic during firmware release This fix addresses a kernel panic that occurred during the release of firmware in a stress test scenario where WLAN and Bluetooth firmware downloads occur...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: check for NULL in btrtlsetuprealtek If a USB dongle is inserted whose chip is not maintained in the icidtable, it will lead to a NULL access. Adding a NULL check can prevent Kernel Oops...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: Disable SCO support if READVOICESETTING is not supported/broken. A SCO connection with incorrect voice settings can cause the controller to lock up...

kernel: Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free Read in l2capsendcmd After the hci sync command releases l2capconn, the hci receive data work queue references the released l2capconn when sending to the upper layer. Add hci dev lock to...

kernel: Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free Read in l2capsendcmd After the hci sync command releases l2capconn, the hci receive data work queue references the released l2capconn when sending to the upper layer. Add hci dev lock to...

TencentOS Server 3: bluez (TSSA-2024:1141)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:1141 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

The vulnerability of the hci_cmd_sync_clear() function in the Linux operating system’s Bluetooth kernel implementation allows a intruder to cause a service failure.

The vulnerability of the hcicmdsyncclear function in the Linux operating system’s Bluetooth kernel implementation is related to the use of memory after it is freed due to a race condition. Exploiting this vulnerability could allow an attacker to cause a service failure...

TencentOS Server 4: bluez (TSSA-2024:0436)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0436 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...